As increasing volumes of information are digitally transmitted over networks, individuals and organizations may seek improved ways to control and/or analyze such network traffic. Some methods of controlling network traffic rely on the ability to classify various network streams according to the type of information carried by that network stream. Classifying network traffic may be used in a variety of contexts, including enforcement of network-traffic policies and/or identification of malware. For example, an organization may block network streams categorized under the “social media” classification.
Unfortunately, traditional methods for identifying and classifying network streams may require prior knowledge of the application that generated the network stream in order to properly identify and analyze the network stream. Other traditional methods for identifying and classifying network streams may require a software agent to be present on endpoint devices that generate network streams. Furthermore, traditional methods for classifying network activity may simply classify network traffic based on the application that generated the network stream and accordingly fail to provide adequately fine-grained control that would allow an administrator to control network traffic on a case-by-case basis. The instant disclosure therefore identifies and addresses a need for improved systems and methods to automatically classify application network activity.